Network attack monitoring method

Abstract

The invention relates to the technical field of networks, in particular to a network attack monitoring method, which comprises the following steps of: S1, deploying a source network load storage cooperative control system and a data packet analysis tool, and comprehensively monitoring and analyzing network traffic; s2, based on the source network load storage cooperative control system, obtaining a running log file of the system, and preprocessing the obtained data; through edge computing node configuration, data can be processed locally, the risk of data transmission is reduced, the data security and user privacy protection are improved, data processing is carried out at a position close to a data source through edge computing, and the delay of data transmission is greatly reduced; through data-driven association rule analysis, potential relationships and modes in a data set can be disclosed, and through association rule analysis, potential security threats or attack modes can be identified more accurately, so that the accuracy of attack association matching is improved, and a powerful guarantee is provided for sustainable development of a power system.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a network attack monitoring method. Background Art

[0002] In the context of coordinated interaction between sources, grids, loads and storage, the construction of new energy systems is characterized by the dominance of new energy, large-scale access to new equipment and extensive application of new technologies. A coordinated control system for sources, grids, loads and storage resources has been established, and its application in various scenarios has been realized through data management fusion technology, data unified service technology, and resource holographic perception technology. However, due to the high proportion and fragmented access of massively distributed new energy sites, the number of network security defense thresholds has increased, and network attack monitoring and protection are extremely important.

[0003] A Chinese patent with publication number CN115603989A discloses a method for analyzing the correlation of network attacks in a source-grid-load-storage collaborative control system. First, the log file of the source-grid-load-storage collaborative control system is obtained for parsing to obtain data on abnormal events involving network attack scenarios. Second, the collected data is preprocessed to filter out irrelevant items and duplicate items to generate a set of network attack abnormal event items. The FP-Growth algorithm is used to perform event correlation analysis on the data to mine the association rules between abnormal information and network attack scenarios. Finally, a gray correlation analysis is used to construct an attack correlation matching module for the source-grid-load-storage collaborative control system to correlate and match real-time events to achieve rapid identification of attack scenarios. By mining the association rules between abnormal events and network attacks, online matching of abnormal events is achieved, which can timely discover potential threats, identify attack scenarios, and deploy corresponding protection strategies.

[0004] In the current existing technology, the attack correlation matching module of the source-grid-load-storage collaborative control system is constructed using grey correlation analysis, which can quickly identify abnormal events similar to known attack patterns. However, when processing large-scale data, the computational complexity is still high and may require a long processing time. Moreover, since the correlation between abnormal events and attack scenarios may not correspond one-to-one, there is a possibility of false alarms, and the algorithm needs to be further optimized to reduce the false alarm rate.

[0005] To this end, the present invention provides a network attack monitoring method. Summary of the invention

[0006] To this end, the technical problem to be solved by the present invention is to overcome the fact that when processing large-scale data in the prior art, the computational complexity is still high, which may require a long processing time; and because the association between abnormal events and attack scenarios may not be one-to-one corresponding, there is a possibility of false alarms, and the algorithm needs to be further optimized to reduce the false alarm rate.

[0007] To solve the above technical problems, the present invention provides a network attack monitoring method, comprising the following steps:

[0008] S1: Deploy source-grid-load-storage collaborative control systems and data packet analysis tools to comprehensively monitor and analyze network traffic;

[0009] S2: Based on the source-grid-load-storage coordinated control system, obtain its operation log file, pre-process the obtained data, and filter out data that is irrelevant to the network attack scenario and is repeated;

[0010] S3: Use anomaly detection by building models of normal network traffic and system behavior and then monitoring abnormal behaviors that are inconsistent with the model;

[0011] S4: Use behavioral analysis methods to analyze user behaviors and traffic patterns in the network to determine the types of network attacks suffered by the source-grid-load-storage collaborative control system and the types of abnormal events generated after the attacks;

[0012] S5: Use the Eclat algorithm and FP-Growth algorithm to jointly mine association rules and the depth-first search algorithm to obtain the frequent item sets of abnormal events caused by network attacks;

[0013] S6: A variety of methods are combined to analyze and construct an attack correlation matching module for the source-grid-load-storage collaborative control system, which correlates and matches real-time events to achieve rapid identification of attack scenarios.

[0014] In one embodiment of the present invention, the method for constructing the attack association matching module of the source-grid-load-storage collaborative control system includes data-driven association rule analysis and edge computing node configuration. The attack association matching module of the source-grid-load-storage collaborative control system is constructed based on the combination of the data-driven association rule analysis and edge computing node configuration, and is implemented by the following steps:

[0015] S601: Establishing an abnormal event sequence by analyzing the system log file;

[0016] S602: mining frequent item sets based on the Eclat algorithm and the FP-Growth algorithm, and generating association rules;

[0017] S603: Deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time;

[0018] S604: Configure the edge computing node to ensure that it has sufficient computing resources and storage capacity to process the association rule analysis task;

[0019] S605: The edge computing node can receive data from the source grid load storage system in real time, and use the association rule analysis module to process and analyze it;

[0020] S606: Through real-time analysis, abnormal events and potential attack behaviors can be discovered in time, and corresponding security measures can be taken.

[0021] In one embodiment of the present invention, the Eclat algorithm and the FP-Growth algorithm in S5 are combined to jointly perform association rule mining, the Eclat algorithm is used to quickly discover frequent item sets; the FP-Growth algorithm is used to construct an FP tree and further mine association rules; the method of combining the Eclat algorithm and the FP-Growth algorithm is implemented by the following steps:

[0022] S501: Data preprocessing: Clean and preprocess the original data set and convert the data into a vertical data format suitable for processing by the Eclat algorithm;

[0023] S502: Use the Eclat algorithm to find frequent item sets: Using the high efficiency and memory optimization characteristics of the Eclat algorithm, all frequent item sets are quickly found through a depth-first search strategy;

[0024] S503: Construct FP tree: construct FP tree according to the frequent item sets found by Eclat algorithm, and then mine frequent item sets from the tree by recursively traversing the FP tree;

[0025] S504: Generate association rules: Generate association rules based on the mined frequent item sets.

[0026] In one embodiment of the present invention, the behavior analysis method in S4 comprises the following steps:

[0027] S401: User behavior analysis: monitor user operation habits and access frequency, and discover potential signs of network attacks by comparing normal behavior with abnormal behavior;

[0028] S402: Traffic pattern analysis: Real-time monitoring of network traffic, analysis of traffic trends, peak and valley values, etc., identification of abnormal traffic patterns; tracking of data packets through traffic analysis technology, and detection of malicious traffic;

[0029] S403: Determine the type of network attack suffered by combining user behavior analysis and traffic pattern analysis;

[0030] S404: Identify the type of abnormal event based on the attack behavior to provide a basis for subsequent defense and recovery.

[0031] In one embodiment of the present invention, the S3 anomaly detection method is to establish a model that describes normal network traffic and system behavior, and then continuously monitor actual network activities, and mark behaviors that are inconsistent with the model as abnormal behaviors; set reasonable thresholds and alarm mechanisms, and when the abnormal behavior exceeds a certain level, trigger an alarm and notify relevant personnel to handle it.

[0032] In one embodiment of the present invention, the preprocessing of the acquired data in S2 includes filtering irrelevant data and removing duplicate data; the filtering of irrelevant data is used to remove data irrelevant to the network attack scenario, and only retains data that may be related to the network attack; the removal of duplicate data is used to check and delete duplicate records to ensure the uniqueness and accuracy of the data.

[0033] In one embodiment of the present invention, S1 can be implemented by the following steps:

[0034] S101: Deploy collaborative control systems: Establish a power grid system operation monitoring platform, and intelligently match collaborative control strategies through algorithm calculation and analysis;

[0035] S102: Configure data architecture: Adopt a horizontally integrated and vertically connected system architecture to support fast database reading and writing to support data collection, transmission and storage;

[0036] S103: Real-time data processing: Perform fast base state flow calculation and fast state estimation on power grid data to provide data support for calculating source-grid-load-storage collaborative optimization strategy;

[0037] S104: Deploy a data packet analysis tool: deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time;

[0038] S105: Comprehensive monitoring and analysis: Through the deployment of collaborative control systems and data packet analysis tools, network traffic is comprehensively monitored and analyzed; abnormal events and potential attack behaviors are discovered, and corresponding security measures are taken.

[0039] In one embodiment of the present invention, the power grid system operation monitoring platform includes a data interaction and acquisition module, an operation status monitoring module, a platform deployment and testing module, and an optimization and maintenance module; the data interaction and acquisition module includes a data source, a data interface, a data integration unit, and a data storage unit; the data source includes power grid system monitoring information, equipment operation monitoring information, and power transmission and transformation online monitoring information; the data interface is used to transmit and parse each of the data sources; the data integration unit is used to integrate the data of the data source to form a unified data stream; the data storage: select a suitable database or data warehouse technology to store and manage the integrated data to ensure the integrity and security of the data.

[0040] In one embodiment of the present invention, the operation status monitoring module includes a real-time data acquisition unit, a data processing and analysis unit and a visual display unit; the real-time data acquisition unit is used to collect the operation data of the power grid system in real time, and is connected to one end of the data interaction and acquisition module; the data processing and analysis unit is used to process and analyze the collected data to generate monitoring reports and early warning information; the visual display unit uses charts to display the monitoring data to the user in an intuitive manner, so that the user can quickly understand the operation status of the power grid system.

[0041] In one embodiment of the present invention, the platform deployment and testing module is used to deploy the developed platform to a suitable cloud platform and test each functional module and performance of the platform; the optimization and maintenance module is used to continuously optimize the functions and performance of the platform based on user feedback and actual operating conditions; regularly maintain and update the platform to ensure its long-term stable operation; and send early warnings in real time to prevent potential risks.

[0042] The above technical solution of the present invention has the following advantages compared with the prior art:

[0043] The detection method and network attack monitoring method of the present invention, by setting data-driven association rule analysis and edge computing node configuration, can process data locally through edge computing node configuration, reduce the risk of data transmission, improve data security and user privacy protection, and edge computing places data processing close to the data source, greatly reducing the delay of data transmission; through data-driven association rule analysis, association rule analysis can reveal the potential connections and patterns within the data set, and through association rule analysis, potential security threats or attack patterns can be more accurately identified, thereby improving the accuracy of attack association matching; the combination of the two methods helps to improve the security and stability of the system and provide a strong guarantee for the sustainable development of the power system.

[0044] The network attack monitoring method described in the present invention sets Eclat and FP-Growth algorithms, quickly discovers frequent item sets through the Eclat algorithm, quickly mines frequent item sets through the FP-Growth algorithm, generates association rules, and combines the advantages of the Eclat algorithm and the FP-Growth algorithm to jointly mine association rules, which helps to better cope with complex and changeable data mining tasks and improve the quality and efficiency of mining results. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to make the contents of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings.

[0046] Figure 1 It is a flow chart of the method for network attack monitoring in the present invention;

[0047] Figure 2 is a flow chart of a method for deploying a control system and a data packet in the present invention;

[0048] Figure 3 It is a schematic diagram of the framework of the power grid system operation monitoring platform in the present invention;

[0049] Figure 4 is a method flow chart of the behavior analysis method of the present invention;

[0050] Figure 5 It is a flow chart of the method combining the Eclat algorithm and the FP-Growth algorithm in the present invention;

[0051] Figure 6 It is a flow chart of a method for constructing an attack correlation matching module of a source-grid-load-storage collaborative control system in the present invention; DETAILED DESCRIPTION

[0052] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0053] See also Figure 1 - Figure 6 The present invention provides a network attack monitoring method, comprising the following steps:

[0054] S1: Deploy source-grid-load-storage collaborative control systems and data packet analysis tools to comprehensively monitor and analyze network traffic;

[0055] S2: Based on the source-grid-load-storage coordinated control system, obtain its operation log file, pre-process the obtained data, and filter out data that is irrelevant to the network attack scenario and is repeated;

[0056] S3: Use anomaly detection by building models of normal network traffic and system behavior and then monitoring abnormal behaviors that are inconsistent with the model;

[0057] S4: Use behavioral analysis methods to analyze user behaviors and traffic patterns in the network to determine the types of network attacks suffered by the source-grid-load-storage collaborative control system and the types of abnormal events generated after the attacks;

[0058] S5: Use the Eclat algorithm and FP-Growth algorithm to jointly mine association rules and the depth-first search algorithm to obtain the frequent item sets of abnormal events caused by network attacks;

[0059] S6: A variety of methods are combined to analyze and construct an attack correlation matching module for the source-grid-load-storage collaborative control system, which correlates and matches real-time events to achieve rapid identification of attack scenarios.

[0060] When the network attack monitoring method provided by the present invention is used, the source-grid-load-storage collaborative control system and the data packet analysis tool are first deployed to comprehensively monitor and analyze the network traffic; based on the source-grid-load-storage collaborative control system, its operation log file is obtained, the obtained data is pre-processed, and the data irrelevant to the network attack scenario and repeated data are filtered out; an anomaly detection method is adopted to establish a model of normal network traffic and system behavior, and then abnormal behaviors inconsistent with the model are monitored; a behavioral analysis method is adopted to analyze user behaviors, traffic patterns, etc. in the network, and determine the type of network attack suffered by the source-grid-load-storage collaborative control system and the type of abnormal events generated after the attack; and the Eclat and FP-Growth algorithms are combined to jointly perform association rule mining. Mining, depth-first search algorithm, to obtain the data frequent item sets of abnormal events caused by network attacks; finally, the combination of data-driven association rule analysis and edge computing node configuration method is used to analyze and construct the attack association matching module of the source-grid-load-storage collaborative control system, to associate and match real-time events, and to achieve rapid identification of attack scenarios; the Eclat and FP-Growth algorithms work together to facilitate the rapid discovery of frequent item sets and generate association rules; combining data-driven association rule analysis and edge computing node configuration methods, an efficient, accurate and reliable attack association matching module of the source-grid-load-storage collaborative control system can be constructed, which helps to improve the security and stability of the system and provide strong guarantees for the sustainable development of the power system.

[0061] Furthermore, if Figure 6 As shown, the method for constructing the attack association matching module of the source-grid-load-storage collaborative control system includes data-driven association rule analysis and edge computing node configuration. The attack association matching module of the source-grid-load-storage collaborative control system is constructed based on the combination of the data-driven association rule analysis and edge computing node configuration, and is implemented by the following steps:

[0062] S601: Establishing an abnormal event sequence by analyzing the system log file;

[0063] S602: mining frequent item sets based on the Eclat algorithm and the FP-Growth algorithm, and generating association rules;

[0064] S603: Deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time;

[0065] S604: Configure the edge computing node to ensure that it has sufficient computing resources and storage capacity to process the association rule analysis task;

[0066] S605: The edge computing node can receive data from the source grid load storage system in real time, and use the association rule analysis module to process and analyze it;

[0067] S606: Through real-time analysis, abnormal events and potential attack behaviors can be discovered in time, and corresponding security measures can be taken.

[0068] When the data-driven association rule analysis and edge computing node configuration provided by the present invention are used, data can be processed locally through the edge computing node configuration, reducing the risk of data transmission, improving data security and user privacy protection, and enhancing the stability and reliability of the system. Edge computing places data processing close to the data source, greatly reducing the delay in data transmission; through data-driven association rule analysis, association rule analysis can reveal the potential connections and patterns within the data set. Through association rule analysis, potential security threats or attack patterns can be more accurately identified, thereby improving the accuracy of attack association matching; based on data-driven association rule analysis and edge computing node configuration, the two methods can jointly construct an attack association matching module of the source-grid-load-storage collaborative control system.

[0069] Furthermore, if Figure 5 As shown, the Eclat algorithm and the FP-Growth algorithm in S5 are combined to jointly mine association rules. The Eclat algorithm is used to quickly discover frequent item sets; the FP-Growth algorithm is used to build an FP tree and further mine association rules; the method of combining the Eclat algorithm and the FP-Growth algorithm is implemented by the following steps:

[0070] S501: Data preprocessing: Clean and preprocess the original data set and convert the data into a vertical data format suitable for processing by the Eclat algorithm;

[0071] S502: Use the Eclat algorithm to find frequent item sets: Using the high efficiency and memory optimization characteristics of the Eclat algorithm, all frequent item sets are quickly found through a depth-first search strategy;

[0072] S503: Construct FP tree: construct FP tree according to the frequent item sets found by Eclat algorithm, and then mine frequent item sets from the tree by recursively traversing the FP tree;

[0073] S504: Generate association rules: Generate association rules based on the mined frequent item sets.

[0074] When the Eclat algorithm and the FP-Growth algorithm provided by the present invention are used, frequent item sets are quickly discovered through the Eclat algorithm, and frequent item sets are quickly mined through the FP-Growth algorithm to generate association rules. The advantages of the Eclat algorithm and the FP-Growth algorithm are combined to jointly mine association rules, which helps to better cope with complex and changeable data mining tasks and improve the quality and efficiency of mining results.

[0075] Furthermore, if Figure 4 As shown, the behavioral analysis method in S4 includes the following steps:

[0076] S401: User behavior analysis: monitor user operation habits and access frequency, and discover potential signs of network attacks by comparing normal behavior with abnormal behavior;

[0077] S402: Traffic pattern analysis: Real-time monitoring of network traffic, analysis of traffic trends, peak and valley values, etc., identification of abnormal traffic patterns; tracking of data packets through traffic analysis technology, and detection of malicious traffic;

[0078] S403: Determine the type of network attack suffered by combining user behavior analysis and traffic pattern analysis;

[0079] S404: Identify the type of abnormal event based on the attack behavior to provide a basis for subsequent defense and recovery.

[0080] When the behavior analysis method provided by the present invention is used, during the analysis process:

[0081] User behavior analysis: First, analyze the user's login, operation, access and other behaviors to identify abnormal behavior patterns; then use machine learning algorithms to model and classify user behaviors; finally, identify potential attackers or malicious behaviors based on the user behavior model;

[0082] Traffic pattern analysis: First, analyze the distribution, trend, and abnormal peaks of network traffic to identify possible attack traffic; then use traffic analysis tools to deeply analyze and visualize the traffic; finally, identify the attack type based on traffic characteristics;

[0083] Combine user behavior analysis with traffic pattern analysis to determine the type of network attack suffered; identify the type of abnormal event based on the attack behavior, which helps to take timely response measures, ensure the security and stability of the system, and provide a basis for subsequent defense and recovery.

[0084] Furthermore, if Figure 1As shown, the S3 anomaly detection method is to establish a model that describes normal network traffic and system behavior, and then continuously monitor actual network activities, and mark behaviors that are inconsistent with the model as abnormal behaviors; set reasonable thresholds and alarm mechanisms, and when the abnormal behavior exceeds a certain level, trigger an alarm and notify relevant personnel to handle it.

[0085] When the anomaly detection method provided by the present invention is used, a model is established to describe normal network traffic and system behavior, reasonable thresholds and alarm mechanisms are set, and actual network activities are continuously monitored. When the abnormal behavior exceeds a certain level, an alarm is triggered and relevant personnel are notified to handle it.

[0086] Furthermore, if Figure 1 As shown, the preprocessing of the acquired data in S2 includes filtering irrelevant data and removing duplicate data; the filtering of irrelevant data is used to remove data irrelevant to the network attack scenario, and only retains data that may be related to the network attack; the removal of duplicate data is used to check and delete duplicate records to ensure the uniqueness and accuracy of the data.

[0087] When used, the irrelevant data filtering and duplicate data removal provided by the present invention removes data irrelevant to the network attack scenario and duplicate data for checking and deleting duplicate records, thereby ensuring the uniqueness and accuracy of the data.

[0088] Furthermore, if Figure 2 As shown, S1 can be implemented by the following steps:

[0089] S101: Deploy collaborative control systems: Establish a power grid system operation monitoring platform, and intelligently match collaborative control strategies through algorithm calculation and analysis;

[0090] S102: Configure data architecture: Adopt a horizontally integrated and vertically connected system architecture to support fast database reading and writing to support data collection, transmission and storage;

[0091] S103: Real-time data processing: Perform fast base state flow calculation and fast state estimation on power grid data to provide data support for calculating source-grid-load-storage collaborative optimization strategy;

[0092] S104: Deploy a data packet analysis tool: deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time;

[0093] S105: Comprehensive monitoring and analysis: Through the deployment of collaborative control systems and data packet analysis tools, network traffic is comprehensively monitored and analyzed; abnormal events and potential attack behaviors are discovered, and corresponding security measures are taken.

[0094] When in use, the collaborative control system and data packet analysis tool provided by the present invention deploy the source-grid-load-storage collaborative control system and data packet analysis tool to comprehensively monitor and analyze network traffic, discover abnormal events and potential attack behaviors, and take corresponding security measures to ensure the security and stable operation of the system.

[0095] Furthermore, if Figure 3 As shown, the power grid system operation monitoring platform includes a data interaction and acquisition module, an operation status monitoring module, a platform deployment and testing module, and an optimization and maintenance module; the data interaction and acquisition module includes a data source, a data interface, a data integration unit, and a data storage unit; the data source includes power grid system monitoring information, equipment operation monitoring information, and power transmission and transformation online monitoring information; the data interface is used to transmit and parse each of the data sources; the data integration unit is used to integrate the data of the data source to form a unified data stream; the data storage: select a suitable database or data warehouse technology to store and manage the integrated data to ensure the integrity and security of the data.

[0096] When the data interaction and acquisition module provided by the present invention is used, the data source is first determined, and it is clear from which systems the data needs to be acquired, such as power grid system monitoring information, equipment operation monitoring information, power transmission and transformation online monitoring information, etc.; a suitable data interface is designed for each data source to ensure accurate transmission and analysis of the data; data from different data sources are integrated to form a unified data stream for subsequent processing and analysis; a suitable database or data warehouse technology is selected to store and manage the integrated data to ensure the integrity and security of the data.

[0097] Furthermore, if Figure 3 As shown, the operation status monitoring module includes a real-time data acquisition unit, a data processing and analysis unit and a visual display unit; the real-time data acquisition unit is used to collect the operation data of the power grid system in real time, and is connected to one end of the data interaction and acquisition module; the data processing and analysis unit is used to process and analyze the collected data, and generate monitoring reports and early warning information; the visual display unit uses charts to display the monitoring data to the user in an intuitive manner, so that the user can quickly understand the operation status of the power grid system.

[0098] When in use, the operation status monitoring module provided by the present invention collects the operation data of the power grid system in real time through the data interaction and acquisition module; then the collected data is processed and analyzed to generate monitoring reports and early warning information; finally, the monitoring data is displayed to the user in an intuitive manner in the form of charts, dashboards, etc., so that the user can quickly understand the operation status of the power grid system.

[0099] Furthermore, if Figure 3As shown, the platform deployment and testing module is used to deploy the developed platform to a suitable cloud platform and test each functional module and performance of the platform; the optimization and maintenance module is used to continuously optimize the functions and performance of the platform based on user feedback and actual operation conditions; regularly maintain and update the platform to ensure its long-term stable operation; and send early warnings in real time to prevent potential risks.

[0100] When used, the optimization and maintenance module provided by the present invention continuously optimizes the functions and performance of the platform according to user feedback and actual operation conditions; then regularly maintains and updates the platform to ensure its long-term stable operation; sends network early warnings and fault alarms in real time to ensure that users can understand the safe operation status of the network and its changing trends at any time, thereby preventing potential risks.

[0101] Working principle: First, deploy the source-grid-load-storage collaborative control system and data packet analysis tools to comprehensively monitor and analyze network traffic; based on the source-grid-load-storage collaborative control system, obtain its operation log files, pre-process the acquired data, and filter out data that is irrelevant to the network attack scenario and is repeated; adopt the anomaly detection method to establish a model of normal network traffic and system behavior, and then monitor abnormal behaviors that are inconsistent with the model; adopt the behavioral analysis method to analyze user behaviors and traffic patterns in the network to determine the types of network attacks suffered by the source-grid-load-storage collaborative control system and the types of abnormal events generated after the attack; combine the Eclat and FP-Growth algorithms to jointly mine association rules, and use depth-first search to obtain the abnormal behavior that is inconsistent with the model. The algorithm of search is used to obtain the frequent item sets of abnormal events caused by network attacks; finally, the attack association matching module of the source-grid-load-storage collaborative control system is analyzed and constructed by combining data-driven association rule analysis and edge computing node configuration method, and the real-time events are associated and matched to achieve rapid identification of attack scenarios; the Eclat and FP-Growth algorithms are used together to facilitate the rapid discovery of frequent item sets and generate association rules; combining data-driven association rule analysis and edge computing node configuration methods, an efficient, accurate and reliable attack association matching module of the source-grid-load-storage collaborative control system can be constructed, which helps to improve the security and stability of the system and provide strong guarantee for the sustainable development of the power system.

[0102] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A network attack monitoring method, characterized in that: The following steps are involved: S1: Deploy source-grid-load-storage collaborative control systems and data packet analysis tools to comprehensively monitor and analyze network traffic; S2: Based on the source-grid-load-storage coordinated control system, obtain its operation log file, pre-process the obtained data, and filter out data that is irrelevant to the network attack scenario and is repeated; S3: Use anomaly detection by building models of normal network traffic and system behavior and then monitoring abnormal behaviors that are inconsistent with the model; S4: Use behavioral analysis methods to analyze user behaviors and traffic patterns in the network to determine the types of network attacks suffered by the source-grid-load-storage collaborative control system and the types of abnormal events generated after the attacks; S5: Use the Eclat algorithm and FP-Growth algorithm to jointly mine association rules and the depth-first search algorithm to obtain the frequent item sets of abnormal events caused by network attacks; S6: A variety of methods are combined to analyze and construct an attack correlation matching module for the source-grid-load-storage collaborative control system, which correlates and matches real-time events to achieve rapid identification of attack scenarios.

2. A network attack monitoring method according to claim 1, characterized in that: The method for constructing the attack association matching module of the source-grid-load-storage collaborative control system includes data-driven association rule analysis and edge computing node configuration. The attack association matching module of the source-grid-load-storage collaborative control system is constructed based on the combination of the data-driven association rule analysis and edge computing node configuration, and is implemented by the following steps: S601: Establishing an abnormal event sequence by analyzing the system log file; S602: mining frequent item sets based on the Eclat algorithm and the FP-Growth algorithm, and generating association rules; S603: Deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time; S604: Configure the edge computing node to ensure that it has sufficient computing resources and storage capacity to process the association rule analysis task; S605: The edge computing node can receive data from the source grid load storage system in real time, and use the association rule analysis module to process and analyze it; S606: Through real-time analysis, abnormal events and potential attack behaviors can be discovered in time, and corresponding security measures can be taken.

3. A network attack monitoring method according to claim 2, characterized in that: The Eclat algorithm and the FP-Growth algorithm in S5 are combined to jointly mine association rules. The Eclat algorithm is used to quickly discover frequent item sets; the FP-Growth algorithm is used to build an FP tree and further mine association rules; the method of combining the Eclat algorithm and the FP-Growth algorithm is implemented by the following steps: S501: Data preprocessing: Clean and preprocess the original data set and convert the data into a vertical data format suitable for processing by the Eclat algorithm; S502: Use the Eclat algorithm to find frequent item sets: Using the high efficiency and memory optimization characteristics of the Eclat algorithm, all frequent item sets are quickly found through a depth-first search strategy; S503: Construct FP tree: construct FP tree according to the frequent item sets found by Eclat algorithm, and then mine frequent item sets from the tree by recursively traversing the FP tree; S504: Generate association rules: Generate association rules based on the mined frequent item sets.

4. A network attack monitoring method according to claim 3, characterized in that: The behavioral analysis method in S4 includes the following steps: S401: User behavior analysis: monitor user operation habits and access frequency, and discover potential signs of network attacks by comparing normal behavior with abnormal behavior; S402: Traffic pattern analysis: Real-time monitoring of network traffic, analysis of traffic trends, peak and valley values, etc., identification of abnormal traffic patterns; tracking of data packets through traffic analysis technology, and detection of malicious traffic; S403: Determine the type of network attack suffered by combining user behavior analysis and traffic pattern analysis; S404: Identify the type of abnormal event based on the attack behavior to provide a basis for subsequent defense and recovery.

5. A network attack monitoring method according to claim 4, characterized in that: The anomaly detection method described in S3 is to establish a model that describes normal network traffic and system behavior, and then continuously monitor actual network activities, and mark behaviors that are inconsistent with the model as abnormal behaviors; set reasonable thresholds and alarm mechanisms, and when the abnormal behavior exceeds a certain level, trigger an alarm and notify relevant personnel to handle it.

6. A network attack monitoring method according to claim 5, characterized in that: The preprocessing of the acquired data in S2 includes filtering irrelevant data and removing duplicate data; the filtering of irrelevant data is used to remove data irrelevant to the network attack scenario and only retain data that may be related to the network attack; The deduplication process is used to check and delete duplicate records to ensure the uniqueness and accuracy of the data.

7. A network attack monitoring method according to claim 6, characterized in that: The S1 can be implemented by the following steps: S101: Deploy collaborative control systems: Establish a power grid system operation monitoring platform, and intelligently match collaborative control strategies through algorithm calculation and analysis; S102: Configure data architecture: Adopt a horizontally integrated and vertically connected system architecture to support fast database reading and writing to support data collection, transmission and storage; S103: Real-time data processing: Perform fast base state flow calculation and fast state estimation on power grid data to provide data support for calculating source-grid-load-storage collaborative optimization strategy; S104: Deploy a data packet analysis tool: deploy an association rule analysis module on an edge computing node close to the data source to process and analyze data in real time; S105: Comprehensive monitoring and analysis: Through the deployment of collaborative control systems and data packet analysis tools, network traffic is comprehensively monitored and analyzed; abnormal events and potential attack behaviors are discovered, and corresponding security measures are taken.

8. A network attack monitoring method according to claim 7, characterized in that: The power grid system operation monitoring platform includes a data interaction and acquisition module, an operation status monitoring module, a platform deployment and testing module, and an optimization and maintenance module; the data interaction and acquisition module includes a data source, a data interface, a data integration unit, and a data storage unit; the data source includes power grid system monitoring information, equipment operation monitoring information, and power transmission and transformation online monitoring information; the data interface is used to transmit and parse each of the data sources; the data integration unit is used to integrate the data of the data source to form a unified data stream; the data storage: select a suitable database or data warehouse technology to store and manage the integrated data to ensure the integrity and security of the data.

9. A network attack monitoring method according to claim 8, characterized in that: The operation status monitoring module includes a real-time data acquisition unit, a data processing and analysis unit and a visual display unit; the real-time data acquisition unit is used to collect the operation data of the power grid system in real time, and is connected to one end of the data interaction and acquisition module; the data processing and analysis unit is used to process and analyze the collected data, and generate monitoring reports and early warning information; the visual display unit uses charts to display the monitoring data to the user in an intuitive manner, so that the user can quickly understand the operation status of the power grid system.

10. A network attack monitoring method according to claim 9, characterized in that: The platform deployment and testing module is used to deploy the developed platform to a suitable cloud platform and test each functional module and performance of the platform; the optimization and maintenance module is used to continuously optimize the functions and performance of the platform based on user feedback and actual operation conditions; and regularly maintain and update the platform to ensure its long-term stable operation; And send early warnings in real time to prevent potential risks.

Images